RE: Matter of DN and what's possible

If often happens in timed projects that the best stuff happens at the last minute. One tries and tries to keep to the original mantra (clearly expessed by Henry), and one sees where it just doesnt hold. As one tries, one sees how H vectored by 5 degrees off does work. The art of management is not to get upset that the market actulaly wants Y (where you though it wanted Z). if your first round of funds proves that, it was a good investement! You get some more. For me, coming to the end of this round, the pure and true concept has not met the bar. It is just too hard to read 2 strings from the web, using semantic web technology; given alternatives that do it using trivial web technology. We sawall  the typical reasons why the better world is always just around the corner. Thus, the heart of the simplicity philosophy is not sound. Now , in esetablishing that we learned what the true semantic web is all about. And, I think we see that it is good. Its rich, and it makes the cert a full member of the web (vs a blob). And the critical observation. Rather than having the attitude that some old blob is to be treated as thid class citizen, its now first class again. Leaving the SAN URI as we have known it (for classical de-referencing), leaving the common name in the subject DN as we have known it (useful for cert picker dialogs), and adding the SIA to point to a services access point (for more advanced deferencing operators about the cert:key) is lovely. Now, everything the semantic web does (self-describing everything) comes to bear (at the SIA). Now, the world of linked data (for which the term "crawler" is clearly a mis-nomer) comes a calling.  Now, I get cert stores in the data cloud (all billion of them). Windows already has n cert stores "documents" (registry, AD, smartcard, .sst), and can have 1 more with ey another a plugin to the provider API. Then, when a browser talks to my https name, the validation services accessed by SIA can talk about that name, including handling the thing that has bugged the world of https since its inception - how to make everyone have their own list of root keys. Solve that, one can have a knighthood. In fact, you have have two if then different lists can relate to each other (so consumers MIGHT delegate to some professional circle in one moment, their govermnet in another, and their circle of friedns on facebook when chatting online. This looks entirely doable.